[Bug 21349] New: Instructors with special characters (e.g. $, ., :) in their cardnumber cannot be removed from course reserves
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Bug ID: 21349 Summary: Instructors with special characters (e.g. $, ., :) in their cardnumber cannot be removed from course reserves Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Course reserves Assignee: koha-bugs@lists.koha-community.org Reporter: ephetteplace@cca.edu QA Contact: testopia@bugs.koha-community.org To recreate: - create a patron with a barcode that contains a character that is meaningful for CSS/jQuery selectors: comma, $, ., :, [, ], =, or @ - create a course and add them to it as an instructor - on /cgi-bin/koha/course_reserves/course.pl?course_id={{course_id}} click the "remove" link attempting to remove them from the course - ...nothing happens The source of this issue is the RemoveInstructor JavaScript function in koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt - it accepts a single "cardnumber" parameter which isn't sanitized before being used in a jQuery selector. Therefore if punctuation that's meaningful in a selector appears in a patron's barcode, the function throws an error. Here's an actual example from our Koha instance: Uncaught Error: Syntax error, unrecognized expression: #borrower_PCAC000029831$ at Function.fa.error (jquery-2.2.3.min.js:2) at fa.tokenize (jquery-2.2.3.min.js:2) at fa.select (jquery-2.2.3.min.js:2) at Function.fa [as find] (jquery-2.2.3.min.js:2) at n.fn.init.find (jquery-2.2.3.min.js:2) at n.fn.init.a.fn.find (jquery-migrate-1.3.0.min.js:2) at a.fn.init.n.fn.init (jquery-2.2.3.min.js:2) at new a.fn.init (jquery-migrate-1.3.0.min.js:2) at n (jquery-2.2.3.min.js:2) at RemoveInstructor (course.pl?course_id=39:224) The solution to this is to sanitize the cardnumber before using it, as described by this article for instance: https://learn.jquery.com/using-jquery-core/faq/how-do-i-select-an-element-by... I'll send along a patch shortly. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Eric Phetteplace <ephetteplace@cca.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ephetteplace@cca.edu --- Comment #1 from Eric Phetteplace <ephetteplace@cca.edu> --- Created attachment 78835 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=78835&action=edit Fix RemoveInstructor function -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Eric Phetteplace <ephetteplace@cca.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Change sponsored?|--- |Sponsored Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com Status|Needs Signoff |Failed QA Assignee|koha-bugs@lists.koha-commun |mtompset@hotmail.com |ity.org | --- Comment #2 from M. Tompsett <mtompset@hotmail.com> --- The patch submitted by Eric Phetteplace applies, but does not solve the problem. I created a user with the barcode of "Ka-boom:Ka-boom!KABOOM@#$!", and was not able to remove the user. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #78835|0 |1 is obsolete| | --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- Comment on attachment 78835 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=78835 Fix RemoveInstructor function Counter patch incoming. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 79057 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79057&action=edit Bug 21349: Change cardnumber to borrowernumber The cardnumber can contain strange non-javascript-friendly characters. This patch converts all the internal references to borrowernumber, but displays the cardnumber when showing list of matching users. TEST PLAN --------- 1) Make sure Course Reserves is being used. Check system preferences. 2) Make sure there is a Course entered. 3) Make sure there is a patron with an cardnumber which breaks the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!) 4) Go into the course list. 5) Click the course name link 6) In the "Instructor Search" box enter the patron name. 7) Select the patron which has the ugly cardnumber. 8) Click Save -- The course listing should have the new teacher listed. 9) Click the course name link again. 10) Click 'Remove' beside the instructor's name. -- nothing happens, and inspecting the error console gives you the ugly error described in comment #0 11) apply this patch 12) restart_all 13) sudo service apache2 restart 14) refresh the page. 15) click 'Remove' beside the instructor's name. -- name is removed. 16) Click Save -- the course listing no longer lists the new teacher. 17) Actually confirm that adding and removing others normally works as expected. 18) run koha qa test tools. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 pierre-marc.thibault@inlibro.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pierre-marc.thibault@inlibr | |o.com Status|Needs Signoff |Patch doesn't apply --- Comment #5 from pierre-marc.thibault@inlibro.com --- An error occured when I tried to apply the patch. Can you check the patch to fix it please? Thank you. Applying: Bug 21349: Change cardnumber to borrowernumber fatal: sha1 information is lacking or useless (koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt). error: could not build fake ancestor Patch failed at 0001 Bug 21349: Change cardnumber to borrowernumber The copy of the patch that failed is found in: .git/rebase-apply/patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-21349-Change-cardnumber-to-borrowernumber-6lnMN1.patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79057|0 |1 is obsolete| | --- Comment #6 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 79263 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79263&action=edit Bug 21349: Instructors with special characters in cardnumber cannot be removed from course reserves The cardnumber can contain strange non-javascript-friendly characters. This patch converts all the internal references to borrowernumber, but displays the cardnumber when showing list of matching users. TEST PLAN --------- 1) Make sure Course Reserves is being used. Check system preferences. 2) Make sure there is a Course entered. 3) Make sure there is a patron with an cardnumber which breaks the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!) 4) Go into the course list. 5) Click the course name link 6) In the "Instructor Search" box enter the patron name. 7) Select the patron which has the ugly cardnumber. 8) Click Save -- The course listing should have the new teacher listed. 9) Click the course name link again. 10) Click 'Remove' beside the instructor's name. -- nothing happens, and inspecting the error console gives you the ugly error described in comment #0 11) apply this patch 12) restart_all 13) sudo service apache2 restart 14) refresh the page. 15) click 'Remove' beside the instructor's name. -- name is removed. 16) Click Save -- the course listing no longer lists the new teacher. 17) Actually confirm that adding and removing others normally works as expected. 18) run koha qa test tools. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Charles Farmer <charles.farmer@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Charles Farmer <charles.farmer@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79263|0 |1 is obsolete| | --- Comment #7 from Charles Farmer <charles.farmer@inlibro.com> --- Created attachment 81338 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=81338&action=edit Bug 21349: Instructors with special characters in cardnumber cannot be removed from course reserves The cardnumber can contain strange non-javascript-friendly characters. This patch converts all the internal references to borrowernumber, but displays the cardnumber when showing list of matching users. TEST PLAN --------- 1) Make sure Course Reserves is being used. Check system preferences. 2) Make sure there is a Course entered. 3) Make sure there is a patron with an cardnumber which breaks the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!) 4) Go into the course list. 5) Click the course name link 6) In the "Instructor Search" box enter the patron name. 7) Select the patron which has the ugly cardnumber. 8) Click Save -- The course listing should have the new teacher listed. 9) Click the course name link again. 10) Click 'Remove' beside the instructor's name. -- nothing happens, and inspecting the error console gives you the ugly error described in comment #0 11) apply this patch 12) restart_all 13) sudo service apache2 restart 14) refresh the page. 15) click 'Remove' beside the instructor's name. -- name is removed. 16) Click Save -- the course listing no longer lists the new teacher. 17) Actually confirm that adding and removing others normally works as expected. 18) run koha qa test tools. Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|Trivial patch |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #81338|0 |1 is obsolete| | --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 81383 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=81383&action=edit Bug 21349: Instructors with special characters in cardnumber cannot be removed from course reserves The cardnumber can contain strange non-javascript-friendly characters. This patch converts all the internal references to borrowernumber, but displays the cardnumber when showing list of matching users. TEST PLAN --------- 1) Make sure Course Reserves is being used. Check system preferences. 2) Make sure there is a Course entered. 3) Make sure there is a patron with an cardnumber which breaks the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!) 4) Go into the course list. 5) Click the course name link 6) In the "Instructor Search" box enter the patron name. 7) Select the patron which has the ugly cardnumber. 8) Click Save -- The course listing should have the new teacher listed. 9) Click the course name link again. 10) Click 'Remove' beside the instructor's name. -- nothing happens, and inspecting the error console gives you the ugly error described in comment #0 11) apply this patch 12) restart_all 13) sudo service apache2 restart 14) refresh the page. 15) click 'Remove' beside the instructor's name. -- name is removed. 16) Click Save -- the course listing no longer lists the new teacher. 17) Actually confirm that adding and removing others normally works as expected. 18) run koha qa test tools. Signed-off-by: Charles Farmer <charles.farmer@inLibro.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Status|Passed QA |Pushed to Master --- Comment #9 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |martin.renvoize@ptfs-europe | |.com --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.05.x for 18.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21349 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |RESOLVED CC| |fridolin.somers@biblibre.co | |m Resolution|--- |FIXED --- Comment #11 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.11.x for 17.11.13 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org